Bug 2264099 (CVE-2024-25983) - CVE-2024-25983 MSA-24-0006: IDOR on dashboard comments block
Summary: CVE-2024-25983 MSA-24-0006: IDOR on dashboard comments block
Keywords:
Status: CLOSED UPSTREAM
Alias: CVE-2024-25983
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2264913 2264914
Blocks: 2264073
TreeView+ depends on / blocked
 
Reported: 2024-02-13 21:39 UTC by Zack Miele
Modified: 2024-10-22 09:10 UTC (History)
4 users (show)

Fixed In Version: moodle 4.3.3, 4.2.6 and 4.1.9
Clone Of:
Environment:
Last Closed: 2024-03-22 15:30:29 UTC
Embargoed:


Attachments (Terms of Use)

Description Zack Miele 2024-02-13 21:39:35 UTC
MSA-24-0006: IDOR on dashboard comments block

Description: Insufficient checks in a web service made it possible to
add comments to the comments block on another user's
dashboard when it was not otherwise available (eg on their
profile page).
Issue summary: IDOR on dashboard comments block
Severity/Risk: Minor
Versions affected: 4.3 to 4.3.2, 4.2 to 4.2.5, 4.1 to 4.1.8 and earlier
unsupported versions
Versions fixed: 4.3.3, 4.2.6 and 4.1.9
Reported by: BA7MAN
Issue no.: MDL-78300
CVE identifier: Pending
Changes (master):
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78300

Comment 1 Robb Gatica 2024-02-19 16:01:15 UTC
Created moodle tracking bugs for this issue:

Affects: epel-all [bug 2264914]
Affects: fedora-all [bug 2264913]

Comment 2 shamrocksmelt 2024-03-05 09:35:09 UTC Comment hidden (spam)
Comment 3 Zack Miele 2024-03-22 15:30:27 UTC
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.

Comment 4 Delmer Compton 2024-06-26 09:10:46 UTC Comment hidden (spam)
Comment 5 FrancisMoses 2024-09-17 07:27:41 UTC Comment hidden (spam)
Comment 6 FrancisMoses 2024-09-17 07:28:10 UTC Comment hidden (spam)
Comment 7 FrancisMoses 2024-09-17 07:28:31 UTC Comment hidden (spam)
Comment 8 ProlificPollen 2024-10-22 09:10:25 UTC Comment hidden (spam)

Note You need to log in before you can comment on or make changes to this bug.